This advisory covers six distinct vulnerabilities in the golang packages for Red Hat Enterprise Linux 10. The issues include CVE-2026-27140, which allows arbitrary code execution via malicious SWIG file names; CVE-2026-27143, a possible memory corruption after bound check elimination; CVE-2026-27144, a no-op interface conversion bypassing overlap checking; CVE-2026-32280, a denial of service vulnerability in certificate chain building; CVE-2026-32282, where Root.Chmod can follow symlinks out of the root directory; and CVE-2026-32283, a denial of service via multiple TLS 1.3 key update messages. Red Hat has issued an update to golang version 1.25.9-3.el10_1 to remediate these vulnerabilities.

The vulnerabilities collectively impact the security of the Go compiler and related cryptographic libraries, potentially allowing attackers to execute arbitrary code, cause denial of service conditions, or trigger memory corruption. These issues could affect applications compiled with the vulnerable golang packages or systems relying on Go's crypto/tls and crypto/x509 packages for secure communications.

Red Hat has released an updated golang package version 1.25.9-3.el10_1 for Red Hat Enterprise Linux 10 that addresses these vulnerabilities. Users should apply this update promptly by following the instructions in the Red Hat advisory (https://access.redhat.com/articles/11258). No other mitigation steps are indicated by the vendor advisory.